CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but not including) 5.0.10, and 6.0.0 up to (but not including) 6.0.3 contain a reflected Cross-Site Scripting (XSS) vulnerability where an attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's browser session. This issue has been fixed in versions 5.0.10 and 6.0.3.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44230.json"
}

References

Affected packages

Git / github.com/bestpractical/rt

Affected ranges

Type

GIT

Repo

https://github.com/bestpractical/rt

Events

Introduced

0c0f0b05c77d54dff91e2345cbfe7fd5d5d9444b

Introduced

84623aa0fd0dcc02d1821866d37ac824a902cec8

Fixed

51f63bbd924b9277ec6d2db49a6d89e8f25da141

Fixed

4a8ed900956527a8845f22a7ab011ec3225be91b

Database specific

{
    "extracted_events": [
        {
            "introduced": "5.0.4"
        },
        {
            "fixed": "5.0.10"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44230.json"